Intermediate control principles for secure development (required, with baseline, of an AI whose inherent risk is medium). Processes mitigate vulnerabilities found during secure development; applications, including internet-facing web applications, are tested against known attack types (SQL injection, cross-site scripting, buffer overflow) before implementation and after significant change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.